Privacy notice

The responsible party is Melsoft Academy (Pty) Ltd — 2022/502518/07, 173 Oxford Road, Rosebank, Sandton, Gauteng, 2196. In this notice “we” and “us” mean that company, and “the platform” means BEE Intelligence.

Reach our information officer at support@melsoftacademy.com. registration with the Information Regulator is in progress.

We collect only what the platform needs to produce a B-BBEE scorecard estimate and to support you in using it. There is no tracking for advertising, and we do not buy or sell personal information.

• Your name, work email address and company name. Required — the platform cannot create an account without them. We ask for nothing else at sign-up: no password, no telephone number, no identity number.
• Scorecard figures you enter — ownership and management percentages, payroll and training spend, procurement and community spend. Voluntary, but each one you leave out is replaced by a labelled sample figure, and the estimate is correspondingly less useful to you.
• Learner and employee records — a name, programme, status, occupational level, qualification, and whether the person has a disability. Voluntary.
• Documents you upload — B-BBEE certificates, payroll extracts and other verification evidence. Voluntary. These may contain personal information about other people, which is addressed in clause 4.
• Technical records — your IP address, the pages you request and sign-in events, kept so we can keep the service secure and working.

We do not use automated decision-making that has a legal consequence for anyone. The scorecard is an estimate you read and act on yourself — see clause 9.

To create and run your account; to calculate and display your estimated B-BBEE scorecard; to let you model changes and keep an implementation plan; to store the evidence you upload and produce an evidence pack; to email you the alerts you have not turned off; to answer questions you put to the AI Advisor; and to arrange a consultation if you ask for one.

Our lawful basis is the performance of our agreement with you, and our legitimate interest in keeping the service secure. Where we rely on your consent — the disability field, and alert emails — you can withdraw it at any time without affecting anything else.

When you enter learner records or upload evidence, you are giving us personal information about other people. You remain responsible for having a lawful basis to do that, and for telling those people. We process it only to produce your scorecard and evidence pack.

Disability status is special personal information under POPIA section 26. The platform treats it accordingly: it is left out of the database query itself rather than merely hidden on screen, so it is never sent to a browser against a named individual unless you explicitly ask to see it. Everywhere else — every score, every report, every export — it appears only as an aggregate count.

We use the following operators to run the platform. Each one is listed with what it actually receives, not with what it might be capable of receiving.

We also share information where the law requires it, or to establish or defend a legal claim. We do not otherwise disclose it to anyone.

If you create a share link, anyone holding that link can see your estimated level, element scores and evidence readiness until it expires or you revoke it. They cannot sign in, change anything, or see your learner records or uploaded documents. Who you give the link to is your decision.

The platform runs on Supabase and Vercel. Your information — including the documents you upload — is stored in Dublin, Ireland (Amazon Web Services region eu-west-1).

Supabase does not currently offer a South African region, so this is a cross-border transfer under POPIA section 72. We rely on the recipient being subject to a law that upholds principles for the processing of personal information substantially similar to POPIA, and on our contracts with each operator. We will not move your information to a country with weaker protection without telling you first.

We are not going to reassure you that your information remains inside your own environment, or inside the country. It does not: it sits with the operators named in clause 5, outside South Africa, and telling you otherwise would be untrue.

Learner and employee records carry a deletion date set five years from the day they are created, which is the B-BBEE verification cycle. A scheduled job runs daily and permanently deletes records past that date. Deletion is permanent, not archival.

Your account information, scorecard figures and uploaded documents are kept while your account is open, and deleted when you ask us to close it. Sign-in attempt records are kept briefly for abuse prevention and store a one-way hash of the email address, never the address itself.

You are entitled to:

• ask what personal information we hold about you, and get a copy;
• have information that is inaccurate, irrelevant or out of date corrected or deleted;
• object to our processing on reasonable grounds;
• withdraw a consent you gave us;
• complain to the Information Regulator; and
• ask a court for relief.

Send any of these to support@melsoftacademy.com. We may need to confirm who you are before we act, and we will answer within a reasonable period. POPIA permits us to charge a prescribed fee for a copy of information; we will tell you before we do.

Self-service export and deletion are not built yet, which is why this clause gives you an address and not a button. We would rather tell you that than show you a button that does nothing.

While signed in you can see what we currently hold, with live counts, on the data and POPIA screen.

If you are not satisfied with how we have handled your information, you can complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

Access to your company’s data is enforced in the database itself, not only in the application. Uploaded documents sit in private storage and are reached through short-lived links. The platform sets a strict content security policy, and sign-in is by emailed link with no password to be stolen or reused.

No service can promise that a breach is impossible. If one happens and it is likely to affect you, we will notify the Information Regulator and you, as POPIA section 22 requires.

If we change how we use your information, we will update this page and, where the change is material, tell you by email. The effective date at the top of this notice is the version in force.

Everything the platform produces is an estimate: “Illustrative estimate · Not a verified B-BBEE score”. It carries no standing with a SANAS-accredited verification agency, and your agency has final authority. The terms of service set that out in full.